ci(preview): split PR image builds from trusted deploys (#2057)

* ci(preview): split PR image builds from trusted deploys

* ci(preview): harden preview artifact handoff

Move the preview image artifact into the trusted preview workflow as a no-secret build job, gate deployment on base-trusted workflow definitions, and keep Cloudflare credentials isolated to the deploy-only job.

Also fail closed when the pushed image reference is not written into wrangler.toml and expand the preview deploy guard to enforce the same-run artifact and permission boundaries.

* ci(preview): move preview builds out of privileged trigger

* ci(preview): avoid secret-shaped wrangler env assignments

* ci(preview): keep wrangler credential env explicit

.github/workflows/pr.yml

@@ -2,9 +2,60 @@ name: Pull Request
 
 on:
   pull_request:
+    types: [opened, synchronize, reopened, labeled]
     paths-ignore:
       - 'charts/**'
 
+permissions:
+  contents: read
+
 jobs:
   ci:
-    uses: ./.github/workflows/ci.yml
+    uses: ./.github/workflows/ci.yml
+
+  preview_image:
+    needs: ci
+    if: |
+      contains(github.event.pull_request.labels.*.name, 'preview-cf') &&
+      (github.event.action != 'labeled' || github.event.label.name == 'preview-cf')
+    name: Build Cloudflare preview image
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+    env:
+      PR_NUMBER: ${{ github.event.pull_request.number }}
+      HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+      IMAGE_TAG: sure-preview-pr-${{ github.event.pull_request.number }}:${{ github.event.pull_request.head.sha }}
+    steps:
+      - name: Checkout PR code
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          persist-credentials: false
+
+      - name: Build preview image without secrets
+        run: |
+          set -euo pipefail
+
+          image_archive="$RUNNER_TEMP/sure-preview-image.tar.gz"
+
+          docker build \
+            --platform linux/amd64 \
+            --build-arg "BUILD_COMMIT_SHA=${HEAD_SHA}" \
+            -f Dockerfile.preview \
+            -t "${IMAGE_TAG}" \
+            .
+
+          docker image inspect "${IMAGE_TAG}" >/dev/null
+          docker save "${IMAGE_TAG}" | gzip -1 > "$image_archive"
+          sha256sum "$image_archive" | awk '{print $1}' > "$RUNNER_TEMP/sure-preview-image.sha256"
+
+      - name: Upload preview image artifact
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        with:
+          name: preview-image-pr-${{ env.PR_NUMBER }}-${{ env.HEAD_SHA }}
+          path: |
+            ${{ runner.temp }}/sure-preview-image.tar.gz
+            ${{ runner.temp }}/sure-preview-image.sha256
+          if-no-files-found: error
+          retention-days: 3

.github/workflows/preview-deploy.yml

@@ -1,93 +1,157 @@
 name: Deploy PR Preview
 
 on:
-  pull_request:
-    types: [opened, synchronize, reopened, labeled]
-    paths-ignore:
-      - 'charts/**'
-      - 'docs/**'
-      - '*.md'
+  workflow_run:
+    workflows: ["Pull Request"]
+    types: [completed]
+
+permissions:
+  contents: read
 
 jobs:
-  deploy-preview:
+  preview-gate:
     if: |
-      contains(github.event.pull_request.labels.*.name, 'preview-cf') &&
-      (github.event.action != 'labeled' || github.event.label.name == 'preview-cf')
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'success'
+    name: Validate preview deployment gates
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      actions: read
+      contents: read
+      pull-requests: read
+    outputs:
+      artifact_name: ${{ steps.preview.outputs.artifact_name }}
+      head_sha: ${{ steps.preview.outputs.head_sha }}
+      pr_number: ${{ steps.preview.outputs.pr_number }}
+      should_deploy: ${{ steps.preview.outputs.should_deploy }}
+
+    steps:
+      - name: Resolve preview request
+        id: preview
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        with:
+          script: |
+            const workflowRun = context.payload.workflow_run;
+            const runPr = workflowRun.pull_requests?.[0];
+
+            core.setOutput('should_deploy', 'false');
+
+            if (!runPr) {
+              core.info('Workflow run is not associated with a pull request');
+              return;
+            }
+
+            const prNumber = runPr.number;
+            const headSha = workflowRun.head_sha;
+
+            const { data: pullRequest } = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: prNumber,
+            });
+
+            if (pullRequest.head.sha !== headSha) {
+              core.setFailed(`Workflow run head SHA ${headSha} does not match PR head ${pullRequest.head.sha}`);
+              return;
+            }
+
+            const hasPreviewLabel = pullRequest.labels.some((label) => label.name === 'preview-cf');
+            if (!hasPreviewLabel) {
+              core.info(`PR ${prNumber} does not have the preview-cf label`);
+              return;
+            }
+
+            const files = await github.paginate(github.rest.pulls.listFiles, {
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: prNumber,
+              per_page: 100,
+            });
+            const workflowChanges = files
+              .map((file) => file.filename)
+              .filter((filename) => filename.startsWith('.github/workflows/'));
+
+            if (workflowChanges.length > 0) {
+              core.setFailed(`Preview deployment requires base-trusted workflow definitions; changed workflow files: ${workflowChanges.join(', ')}`);
+              return;
+            }
+
+            const artifactName = `preview-image-pr-${prNumber}-${headSha}`;
+            const artifacts = await github.paginate(github.rest.actions.listWorkflowRunArtifacts, {
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              run_id: workflowRun.id,
+              per_page: 100,
+            });
+            const artifact = artifacts.find((item) => item.name === artifactName && !item.expired);
+
+            if (!artifact) {
+              core.setFailed(`Pull Request workflow run ${workflowRun.id} did not publish ${artifactName}`);
+              return;
+            }
+
+            core.setOutput('artifact_name', artifactName);
+            core.setOutput('head_sha', headSha);
+            core.setOutput('pr_number', String(prNumber));
+            core.setOutput('should_deploy', 'true');
+
+  deploy-preview:
+    needs: preview-gate
+    if: needs.preview-gate.outputs.should_deploy == 'true'
     name: Deploy to Cloudflare Containers
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 45
     concurrency:
-      group: preview-deploy-${{ github.event.pull_request.number }}
+      group: preview-deploy-${{ needs.preview-gate.outputs.pr_number }}
       cancel-in-progress: true
-    environment:
-      name: preview
+    environment: preview
     permissions:
       actions: read
       contents: read
       pull-requests: write
       deployments: write
     env:
-      PR_NUMBER: ${{ github.event.pull_request.number }}
-      HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+      ARTIFACT_NAME: ${{ needs.preview-gate.outputs.artifact_name }}
+      HEAD_SHA: ${{ needs.preview-gate.outputs.head_sha }}
+      PR_NUMBER: ${{ needs.preview-gate.outputs.pr_number }}
 
     steps:
-      - name: Wait for PR CI to pass
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
-        with:
-          script: |
-            const headSha = process.env.HEAD_SHA;
-            const timeoutMs = 10 * 60 * 1000;
-            const pollMs = 15 * 1000;
-            const startedAt = Date.now();
-            let lastState = 'not found';
-
-            const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-
-            while (Date.now() - startedAt < timeoutMs) {
-              const { data } = await github.rest.actions.listWorkflowRunsForRepo({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                event: 'pull_request',
-                head_sha: headSha,
-                per_page: 20,
-              });
-
-              const prRun = data.workflow_runs.find((run) => run.name === 'Pull Request' && run.head_sha === headSha);
-
-              if (prRun) {
-                lastState = `${prRun.status}/${prRun.conclusion ?? 'pending'}`;
-                core.info(`Pull Request workflow ${prRun.id}: ${lastState}`);
-
-                if (prRun.status === 'completed') {
-                  if (prRun.conclusion === 'success') {
-                    return;
-                  }
-
-                  core.setFailed(`Pull Request workflow concluded with ${prRun.conclusion}`);
-                  return;
-                }
-              }
-
-              await sleep(pollMs);
-            }
-
-            core.setFailed(`Timed out waiting for Pull Request workflow for ${headSha}. Last state: ${lastState}`);
-
-      - name: Checkout PR code
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-        with:
-          path: pr
-          persist-credentials: false
-
       - name: Checkout trusted preview tooling
         uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
-          ref: ${{ github.event.pull_request.base.sha }}
+          ref: ${{ github.event.repository.default_branch }}
           path: trusted
           persist-credentials: false
           sparse-checkout: |
             workers/preview
 
+      - name: Download preview image artifact
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+        with:
+          name: ${{ env.ARTIFACT_NAME }}
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ github.token }}
+          path: ${{ runner.temp }}/preview-image
+
+      - name: Verify preview image artifact checksum
+        run: |
+          set -euo pipefail
+
+          image_archive="$RUNNER_TEMP/preview-image/sure-preview-image.tar.gz"
+          checksum_file="$RUNNER_TEMP/preview-image/sure-preview-image.sha256"
+
+          test -f "$image_archive"
+          test -f "$checksum_file"
+
+          expected_checksum="$(tr -d '[:space:]' < "$checksum_file")"
+          actual_checksum="$(sha256sum "$image_archive" | awk '{print $1}')"
+
+          if [ "$expected_checksum" != "$actual_checksum" ]; then
+            echo "Preview image artifact checksum mismatch" >&2
+            exit 1
+          fi
+
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
@@ -105,18 +169,76 @@ jobs:
           cp trusted/workers/preview/package-lock.json "$preview_dir/package-lock.json"
           cp trusted/workers/preview/tsconfig.json "$preview_dir/tsconfig.json"
           cp trusted/workers/preview/wrangler.toml "$preview_dir/wrangler.toml"
-          cp -R pr/workers/preview/src "$preview_dir/src"
+          cp -R trusted/workers/preview/src "$preview_dir/src"
 
           sed -i "s/\${PR_NUMBER}/${PR_NUMBER}/g" "$preview_dir/wrangler.toml"
           sed -i "s/\${PR_NUMBER}/${PR_NUMBER}/g" "$preview_dir/src/index.ts"
-          sed -i \
-            "s#image = \"../../Dockerfile.preview\"#image = \"${GITHUB_WORKSPACE}/pr/Dockerfile.preview\"#" \
-            "$preview_dir/wrangler.toml"
 
-          cat "$preview_dir/wrangler.toml"
           cd "$preview_dir"
           npm ci --ignore-scripts --no-audit --no-fund
 
+      - name: Load preview image artifact
+        run: |
+          set -euo pipefail
+
+          image_archive="$RUNNER_TEMP/preview-image/sure-preview-image.tar.gz"
+          expected_image="sure-preview-pr-${PR_NUMBER}:${HEAD_SHA}"
+
+          gzip -dc "$image_archive" | docker load
+          docker image inspect "$expected_image" >/dev/null
+
+      - name: Push preview image to Cloudflare registry
+        id: image
+        env:
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_PREVIEW_API_TOKEN || secrets.CLOUDFLARE_API_TOKEN }}
+        run: |
+          set -euo pipefail
+
+          cd "$RUNNER_TEMP/sure-preview-worker"
+          image_tag="sure-preview-pr-${PR_NUMBER}:${HEAD_SHA}"
+          push_log="$RUNNER_TEMP/wrangler-containers-push.log"
+          clean_log="$RUNNER_TEMP/wrangler-containers-push.clean.log"
+
+          ./node_modules/.bin/wrangler containers push "$image_tag" 2>&1 | tee "$push_log"
+          perl -pe 's/\e\[[0-9;]*[A-Za-z]//g' "$push_log" > "$clean_log"
+          image_ref=$(grep -Eo 'registry\.cloudflare\.com/[^[:space:]]+' "$clean_log" | tail -n 1 | tr -d '\r')
+
+          if [ -z "$image_ref" ]; then
+            echo "Could not find Cloudflare registry image reference in wrangler output" >&2
+            exit 1
+          fi
+
+          echo "image_ref=${image_ref}" >> "$GITHUB_OUTPUT"
+
+      - name: Configure trusted preview image reference
+        env:
+          IMAGE_REF: ${{ steps.image.outputs.image_ref }}
+        run: |
+          set -euo pipefail
+
+          config_path="$RUNNER_TEMP/sure-preview-worker/wrangler.toml"
+          # Use Node instead of sed so the replacement preserves TOML string syntax.
+          node - "$config_path" <<'NODE'
+          const fs = require('node:fs');
+
+          const configPath = process.argv[2];
+          const imageRef = process.env.IMAGE_REF;
+
+          if (!imageRef || !imageRef.startsWith('registry.cloudflare.com/')) {
+            throw new Error('Expected a Cloudflare registry image reference');
+          }
+
+          const original = fs.readFileSync(configPath, 'utf8');
+          const updated = original.replace(/image = "[^"]+"/, `image = ${JSON.stringify(imageRef)}`);
+          if (updated === original) {
+            throw new Error('Expected wrangler.toml to contain an image entry to rewrite');
+          }
+          fs.writeFileSync(configPath, updated);
+          NODE
+
+          cat "$config_path"
+
       - name: Create GitHub Deployment
         id: deployment
         uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
@@ -139,8 +261,8 @@ jobs:
       - name: Deploy to Cloudflare Containers
         id: deploy
         env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_PREVIEW_API_TOKEN || secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_WORKERS_SUBDOMAIN: ${{ secrets.CLOUDFLARE_WORKERS_SUBDOMAIN }}
         run: |
           set -euo pipefail
@@ -227,6 +349,7 @@ jobs:
                 body: commentBody
               });
             }
+
       - name: Store cleanup metadata
         if: success()
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6